Runs an essential service, in Australia

Security of Critical Infrastructure Act 2018 (Cth), Part 2C, ss. 30CB, 30CD, 30CM and 30CU; s. 52B · Read the law's page

• This binds the responsible entity for a critical infrastructure asset that the Minister has declared a system of national significance (section 52B), and each of the duties below arises only once the Secretary gives that entity a written notice or determination (reached by declaring that you operate an essential service).
• Where the Secretary has determined that the statutory incident response planning obligations apply to you, adopt and maintain an incident response plan for the system and for cyber security incidents, comply with it, review it regularly, keep it up to date, and give the Secretary a copy as soon as practicable after you adopt or vary it (sections 30CB and 30CD to 30CH).
• Where the Secretary gives you a written notice, undertake a cyber security exercise in relation to the system within the period the notice specifies, which may not end earlier than 30 days after the notice (section 30CM).
• Where the Secretary gives you a written notice, undertake, or cause to be undertaken, a vulnerability assessment in relation to the system within the period the notice specifies (section 30CU).

Security of Critical Infrastructure Act 2018 (Cth), Part 2B, ss. 30BB-30BD and 30BEA; Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022, s. 5 · Read the law's page

• This binds the responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies: an asset the Application Rules specify (among them a critical banking, superannuation, insurance, financial market infrastructure, hospital, electricity, gas, water, data storage or processing or telecommunications asset owned or operated by a carrier), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecommunications services).
• Give the relevant Commonwealth body a report about the incident as soon as practicable, and in any event within 12 hours after you become aware that a cyber security incident has occurred or is occurring and has had, or is having, a significant impact on the availability of the asset (section 30BC(1)). The report may be given orally or in writing.
• If you give the report orally, make a written record of it in the approved form and give a copy to the relevant Commonwealth body within 84 hours after you give the report (section 30BC(3)).
• Give the relevant Commonwealth body a report as soon as practicable, and in any event within 72 hours after you become aware that a cyber security incident has occurred, is occurring or is imminent and has had, is having or is likely to have a relevant impact on the asset (section 30BD(1)).

Security of Critical Infrastructure Act 2018 (Cth), Part 2A, ss. 30AB-30AD; Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, ss. 4 and 8 · Read the law's page

• This binds the responsible entity for a critical infrastructure asset to which Part 2A of the Security of Critical Infrastructure Act 2018 applies: an asset the Critical infrastructure risk management program Rules specify (a critical electricity, gas, water, liquid fuel, food and grocery, freight, broadcasting, data storage or processing or domain name system asset, a critical energy market operator asset, a designated hospital, or a critical financial market infrastructure asset used in connection with the operation of a payment system), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, handle health records or provide financial services).
• Adopt and maintain a written critical infrastructure risk management program that applies to you (section 30AC).
• Comply with the program you have adopted, and review it on a regular basis (sections 30AD and 30AE).
• In the program, identify each hazard with a material risk of a relevant impact on the asset and, so far as it is reasonably practicable, minimise or eliminate that risk and mitigate its impact (section 30AH(1)).
• In the program, establish and maintain a process or system to minimise or eliminate any material risk of a cyber and information security hazard occurring, and to mitigate its relevant impact on the asset, as far as it is reasonably practicable (Rules, section 8(2)).
• Within 12 months after the end of the period in section 4(2) of the Rules, comply with a framework in the Rules' table (AS ISO/IEC 27001:2015, the Essential Eight Maturity Model at maturity level one, the NIST Framework for Improving Critical Infrastructure Cybersecurity, the C2M2 at Maturity Indicator Level 1, or the AESCSF at Security Profile 1) or with an equivalent framework (Rules, section 8(3) to (5)).